in eventvwr under windows logs, setup is a log along with application, security, and system. Win32_NTEventlogFile doesn't show an instance of this log. how does one query the setup log through wmi?

Hi, Maybe the Setup logs is already deleted, so the Event Viewer can not display any log. You may check the file which saved the setup log in %SystemRoot%\System32\Winevt\Logs\Setup.evtx and make sure you do not filter the log via any conditions. Meantime, it is also possible that the Windows Installer Logging is disabled. Please refer the following to enable it. http://support.microsoft.com/kb/223300Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.